Stored Memory Recovery System

ABSTRACT

Various embodiments of systems and methods for preserving saved memory states to which a computer system can be restored are disclosed. In certain embodiments, the systems and methods intercept write operations to protected memory locations and redirect them to alternate memory locations. Embodiments of the systems and methods include creation of a table for each memory state. Certain embodiments additionally include a recovery capability, by which the protected memory in the computer system is capable of being restored or recovered to a recovery point that represents a saved memory state. Further embodiments relate to systems and methods for preventing protected memory locations from being overwritten that utilize a plurality of memory state values.

RELATED APPLICATIONS

This application is a continuation-in-part of, and claims priority to,U.S. patent application Ser. No; 09/420,348, filed Oct. 19, 1999 andtitled “OPERATING SYSTEM AND DATA PROTECTION,” which is herebyincorporated by reference in its entirety. This application also claimspriority under 35 U.S.C. 119(e) to U.S. Provisional Application No.60/424,356, filed Nov. 5, 2002 and titled “STORED MEMORY RECOVERYSYSTEM,” and U.S. Provisional Application No. 60/459,927, filed Mar. 31,2003 and titled “STORED MEMORY RECOVERY SYSTEM,” which are herebyincorporated by reference in their entireties. This application isrelated to U.S. patent application Ser. No. 09/617,338, filed Jul. 17,2000 and titled “OPERATING SYSTEM AND DATA PROTECTION,” which is herebyincorporated by reference in its entirety.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention generally relates to computer systems. Moreparticularly, the present invention relates to systems and methods forpreserving prior states of protected memory to which computer systemscan be restored.

2. Description of the Related Technology

Programs presently exist for backing up data from an area of memory toanother area of memory or to an auxiliary storage device. These programstypically operate by physically copying entire computer files orincremental changes to data stored in files, typically after changes aremade to the files or at certain predetermined time intervals. Some ofthese programs allow for the backing up and restoring of the computeroperating system. Sometimes, the user performs some modification of acomputer file or the operating system that causes corruption of the fileor catastrophic operating system failure of the computing system. Whenthis occurs, the file or operating system would be rendered unusable andunrecoverable.

One example of this involves a user performing some undesirablemodification of the operating system that disables the computing systemand prevents its operation. Another example is when a user desires to“clean up” certain portions of the hard disk of the computing system. Inthis situation, the user may delete certain files within the hard diskwithout a great deal of caution or knowledge as to the consequences ofthe changes being made. A further example is when a computer applicationprogram itself erroneously corrupts data files or operating system data.

Many existing programs for backing up and restoring data consumesignificant computing system resources, for example, processor cycles,memory usage, or disk storage. These systems typically save and restoredata by copying from one location to another. Even if the saving of thedata is done during times of low utilization of the computer system,e.g., during the evening or during the user's lunch break, therestoration can nonetheless be slow and cumbersome due to having to copydata from the backup storage area to the original storage area.

Therefore, what is needed is a system and method that preservesprotected memory in a manner that is transparent to the user, thatincludes multiple recovery points and that does not consume significantcomputer system resources. The system and method would also maintain themultiple recovery points by creating and managing one or more tables,e.g., matrix tables, so that restoring the computer system to a previousrecovery state would be accomplished in a very fast and efficient mannerthat does not require the copying of preserved data from one memorylocation to another.

Further limitations and disadvantages of conventional and traditionalsystems will become apparent to one of skill in the art throughcomparison of such systems with the present invention as set forth inthe remainder of the present application with reference to the drawings.

SUMMARY OF CERTAIN INVENTIVE ASPECTS

The systems and methods of the invention have several features, nosingle one of which is solely responsible for its desirable attributes.Without limiting the scope of the invention as expressed by the claimsthat follow, its more prominent features will now be discussed briefly.After considering this discussion, and particularly after reading thesection entitled “Detailed Description of Certain Embodiments” one willunderstand how the features of the system and methods provide severaladvantages over traditional systems.

One aspect is a method of recovery to one or more previous memory statesin a computer system having a memory, the method comprising receiving awrite request to a first memory location, determining whether said firstmemory location contains protected data, redirecting said write requestto a second memory location if said first memory location containsprotected data, thereby preserving the contents of the first memorylocation for a first recovery, and redirecting a subsequent writerequest to said second memory location to a third memory location,thereby preserving the contents of said second memory location for asecond recovery.

This additionally comprises redirecting a read request to said firstmemory location to said second memory location, thereby returning thecontents of said second memory location in response to said read requestto said first memory location. This further comprises redirecting a readrequest to said second memory location to said third memory location,thereby returning the contents of said third memory location in responseto said read request to said second memory location. This additionallycomprises the above method wherein the memory is accessed via a network.Additionally, this comprises the above method wherein the memory is adisk drive and the memory states are states of the disk drive. Thisadditionally comprises the above method wherein the disk drive isaccessed via a network.

This further comprises the above method wherein the protected datacontained in the first memory location is operating system data of thecomputer system. In addition, this comprises the above method whereinthe first and second recovery points represent one or moreconfigurations of the computer system. This additionally comprises theabove method wherein said first and second recovery points areconfiguration states, memory states, recovery states, sector states, orcomputer states.

An additional aspect is a method of recovery to one or more previousmemory states in a computer system having a memory, the methodcomprising selecting a first addressable memory location as part of afirst recovery point, receiving a write request to said firstaddressable memory location, redirecting said write request to a secondaddressable memory location, selecting said second addressable memorylocation as part of a second recovery point, and redirecting asubsequent write request to said second addressable memory location to athird addressable memory location.

This additionally comprises redirecting a read request to said firstaddressable memory location to said second addressable memory location,thereby returning the contents of said second addressable memorylocation in response to said read request to said first addressablememory location. This further comprises redirecting a read request tosaid second addressable memory location to said third addressable memorylocation, thereby returning the contents of said third addressablememory location in response to said read request to said secondaddressable memory location.

An additional aspect is a method of protecting one or more memorylocations from being overwritten, the method comprising creating a tableof a status of at least one memory location, receiving a write requestto a first memory location, determining if said first memory locationcontains protected data from a status of said first memory location insaid table, redirecting said write request to a second memory locationif said first memory location contains protected data, indicating astatus of said second memory location in said table that said secondmemory location contains protected data, redirecting a write request tosaid second memory location to a third memory location, and indicating astatus of said third memory location in said table that said thirdmemory location contains protected data.

This additionally comprises redirecting a read request to said firstmemory location to said second memory location, thereby returning thecontents of said second memory location in response to said read requestto said first memory location. This further comprises redirecting a readrequest to said second memory location to said third memory location,thereby returning the contents of said third memory location in responseto said read request to said second memory location.

This additionally comprises the above method wherein the one or morememory locations are accessed via a network. This further comprises theabove method wherein the one or more memory locations are locations on adisk drive. This also comprises the above method wherein the disk driveis accessed via a network.

An additional aspect is a method of restoring a computer system to aprevious memory state, the method comprising designating at least onememory location as recovery data associated with a first recovery point,redirecting write requests to said at least one memory location toanother memory location, and recovering to said first recovery point bydesignating said at least one memory location and said another memorylocation as recovery data associated with a second recovery point.

This additionally comprises the above method wherein the memorylocations are accessed via a network. This further comprises the abovemethod wherein the memory locations are locations on a disk drive. Thisalso comprises the above method wherein the disk drive is accessed via anetwork.

An additional aspect is a computer operating system configured topreserve protected memory locations that reside on a computer system andrecover to one or more recovery points that represent a previous stateof said protected memory locations, the computer operating systemcomprising a table containing data indicating the status of saidprotected memory locations, wherein said table is initialized toindicate an original state of said protected memory locations and adriver configured to receive a write request to a first memory location,determine whether said first memory location is a protected memorylocation, if said first memory location is a protected memory location,find a second memory location that has a status of not used, update saidtable to indicate a used status of said second memory location, redirectsaid write request from said first memory location to said second memorylocation, and update said table to indicate a redirected status of saidfirst memory location to said second memory location.

This additionally comprises the above computer operating system whereinthe driver is further configured to redirect a read request to saidfirst memory location to said second memory location, thereby returningthe contents of said second memory location in response to said readrequest to said first memory location. This further comprises the abovecomputer operating system wherein the driver is further configured toreceive a write request to said second memory location, determinewhether said second memory location is a protected memory location, ifsaid second memory location is a protected memory location, find a thirdmemory location that has a status of unused, update said table toindicate a used status of said third memory location, redirect saidwrite request from said second memory location to said third memorylocation, and update said table to indicate a redirected status of saidsecond memory location to said third memory location.

This additionally comprises the above computer operating system whereinthe driver is further configured to redirect a read request to saidsecond memory location to said third memory location, thereby returningthe contents of said third memory location in response to said readrequest to said second memory location. This further comprises the abovecomputer operating system wherein the memory locations are accessed viaa network. This also comprises the above computer operating systemwherein the memory locations are locations on a disk drive. Thisadditionally comprises the above computer operating system wherein thedisk drive is accessed via a network.

An additional aspect is a method of preserving protected memorylocations that reside on a computer system and recovering to one or morerecovery points that represent a previous state of said protected memorylocations, the method comprising initializing a table containing dataindicating the status of said protected memory locations to indicate anoriginal state of said protected memory locations, receiving a writerequest to a first memory location, determining whether said firstmemory location is a protected memory location, if said first memorylocation is a protected memory location, finding a second memorylocation that has a status of not used, updating said table to indicatea used status of said second memory location, redirecting said writerequest from said first memory location to said second memory location,and updating said table to indicate a redirected status of said firstmemory location to said second memory location.

This additionally comprises redirecting a read request to said firstmemory location to said second memory location, thereby returning thecontents of said second memory location in response to said read requestto said first memory location. This further comprises receiving a writerequest to said second memory location, determining whether said secondmemory location is a protected memory location, if said second memorylocation is a protected memory location, finding a third memory locationthat has a status of unused, updating said table to indicate a usedstatus of said third memory location, redirecting said write requestfrom said second memory location to said third memory location, andupdating said table to indicate a redirected status of said secondmemory location to said third memory location.

This further comprises redirecting a read request to said second memorylocation to said third memory location, thereby returning the contentsof said third memory location in response to said read request to saidsecond memory location. This additionally comprises the above methodwherein the memory locations are accessed via a network.

An additional aspect is a method of creating a plurality of tables in acomputer system having protected memory locations, said plurality oftables representing a plurality of recovery points that representprevious states of said protected memory locations, the methodcomprising creating an initial table indicating an original state ofsaid protected memory locations, identifying a new recovery pointrepresenting a new state of said protected memory locations to bepreserved, creating a new table corresponding to said new recoverypoint, wherein said new table is a copy of said initial table, comparingsaid new table to a most recently created previous table, and if saidnew table indicates an unused status for one or more memory locationsfor which corresponding memory locations of said previous table indicatea used status, updating said new table to indicate a status of protectedfor said one or more memory locations.

This additionally comprises the above method wherein the memorylocations are accessed via a network. This further comprises the abovemethod wherein the memory locations are locations on a disk drive. Thisalso comprises the above method wherein the disk drive is accessed via anetwork.

An additional aspect is a computer readable storage medium having storedthereon instructions that when executed by a computer processor performa method of recovery to one or more previous memory states in a computersystem having a memory, the method comprising receiving a write requestto a first memory location, determining whether said first memorylocation contains protected data, redirecting said write request to asecond memory location if said first memory location contains protecteddata, thereby preserving the contents of the first memory location for afirst recovery, and redirecting a subsequent write request to saidsecond memory location to a third memory location, thereby preservingthe contents of said second memory location for a second recovery.

This additionally comprises the above computer readable storage medium,wherein the method further comprises redirecting a read request to saidfirst memory location to said second memory location, thereby returningthe contents of said second memory location in response to said readrequest to said first memory location.

BRIEF DESCRIPTION OF THE DRAWINGS

The above and other aspects, features and advantages of the inventionwill be better understood by referring to the following detaileddescription, which should be read in conjunction with the accompanyingdrawings. These drawings and the associated description are provided toillustrate certain embodiments of the invention, and not to limit thescope of the invention.

FIG. 1 is a block diagram illustrating embodiments of the components ormodules of a computer system with a sector management system.

FIG. 2 is a diagram illustrating the relationship between files,clusters and sectors in a file system such as FAT16 or FAT32.

FIG. 3 is a diagram illustrating a simplified representation of 12sectors, labeled A-L, of a hard disk.

FIG. 4 is a diagram illustrating the sectors of FIG. 3 after theIdentify_Module has identified a set of recovery data.

FIG. 5 is a diagram illustrating a representation of a matrix table,e.g., matrix table 1, associated with the recovery data set 1 discussedabove with regard to FIG. 4.

FIG. 6 is a diagram illustrating an embodiment of a process, matrixtables and sector representations associated with a write request fromthe file system to a sector flagged as Already_Used.

FIG. 7 is a diagram illustrating an embodiment of a process, matrixtables and sector representations associated with a write request fromthe file system to a sector flagged as RS_Free.

FIG. 8 is a diagram illustrating an embodiment of a process, matrixtables and sector representations associated with a write request fromfile system to a sector flagged as RS_Used.

FIG. 9 is a diagram illustrating an embodiment of a process, matrixtables and sector representations associated with a write request fromthe file system to a sector flagged as Newly_Used.

FIG. 10 is a diagram illustrating an embodiment of a process, matrixtables and sector representations associated with a write request fromfile system to a sector flagged as Current_Redirected.

FIG. 11 is a diagram illustrating a representation of the aforementioned12 sectors that indicates a new recovery data set, e.g., recovery dataset 2, identified at a new recovery point, e.g., recovery point 2.

FIG. 12 is a diagram illustrating an embodiment of a second matrixtable, e.g., matrix table 2, corresponding to recovery data set 2 ofFIG. 11.

FIG. 13 is a diagram illustrating an embodiment of a process, matrixtables and sector representations associated with a write request fromfile system to a sector flagged as Previous_Redirected, with respect tomatrix table 2 shown in FIG. 12.

FIG. 14 is a diagram illustrating a representation of the 12 hard disksectors with two identified recovery data sets.

FIG. 15 is a diagram illustrating an embodiment of the correspondingchanges to the working version of matrix table 2 made by theWrites_Module after redirecting to sector I a write request from thefile system to sector H as discussed above with regard to FIG. 14.

FIG. 16 is a diagram illustrating a representation of a new recoverydata set, e.g., recovery data set 3, identified by the Identity_Moduleat recovery point 3.

FIG. 17 is a diagram illustrating an embodiment of a new matrix table,e.g., matrix table 3, created by the Identify_Module.

FIG. 18 is a diagram illustrating a further representation of the 12hard disk sectors with three identified recovery data sets.

FIG. 19 is a diagram illustrating an embodiment of a representation ofthe working version of matrix table 3 after the Writes_Module processesthe write request to sector J.

FIG. 20 is a diagram illustrating an embodiment of an overview of thenewly identified recovery data set, e.g., recovery data set 4.

FIG. 21 is a flowchart illustrating an embodiment of a process performedby the Recover_Module to restore the hard disk to a state reflected by apreviously identified recovery data set.

FIG. 22 is a diagram illustrating in greater detail an embodiment of aprocess, matrix tables and sector representations associated with theembodiment shown in FIG. 20, with the Recover_Module performing theprocess as discussed above with regard to FIG. 21.

FIG. 23 is a diagram illustrating an embodiment of a process, matrixtables and sector representations in which the Recover_Module createsrecovery point 5 to restore to recovery point 3 after creating recoverypoint 4 to recover to recovery point 1 as shown in FIG. 22.

DETAILED DESCRIPTION OF CERTAIN EMBODIMENTS

The following detailed description is directed to certain specificembodiments of the invention. However, the invention can be embodied ina multitude of different ways as defined and covered by the claims. Thescope of the invention is to be determined with reference to theappended claims. In this description, reference is made to the drawingswherein like parts are designated with like numerals throughout.

The sector management system may be comprised of various components ormodules that perform the functionality as described in detail below. Thecomponents or modules may comprise various software sub-routines,procedures, definitional statements and macros. Each of the componentsor modules are typically separately compiled and linked into a singleexecutable program. Therefore, reference to components or modules in thefollowing description is used for convenience to describe thefunctionality of embodiments of the system. Thus, the processes that areundergone by each of the components or modules may be arbitrarilyredistributed to one of the other components or modules, combinedtogether in a single components or module, or made available in, forexample, a shareable dynamic link library.

In certain embodiments, these components or modules may be configured toreside on the addressable storage medium of a computer system andconfigured to execute on a processor, or on multiple processors. Thecomponents or modules include, but are not limited to, software orhardware components that perform certain tasks. Thus, a component ormodule may include, by way of example, software components,object-oriented software components, class components and taskcomponents, processes, functions, attributes, procedures, subroutines,segments of program code, drivers, firmware, microcode, circuitry, data,databases, data structures, tables, arrays, and variables. Furthermore,the functionality provided for in the components or modules may becombined into fewer components, modules, or databases or furtherseparated into additional components, modules, or databases.Additionally, the components or modules may be implemented to execute ona computer, or on multiple computers.

The sector management system is capable of protecting selected datastored in a computer system so that the computer system can be restoredto the state represented by the protected data. Another aspect of thesector management system allows the computer system to be restored tomore than one state. In some embodiments, data is protected from beingoverwritten by redirecting write requests to other locations.

The sector management system may be implemented utilizing various typesof memory storage, e.g., computer memory devices (such as Random AccessMemory, or RAM), removable storage, local hard disks and memory storagethat is accessed via hard disks located remotely and accessed via anetwork. In other embodiments, the sector management system isimplemented utilizing firmware, software (e.g., programs or data) storedin non-volatile memory such as read-only memory (ROM). Types of ROMinclude, for example, programmable read-only memory (PROM), erasableprogrammable read-only memory (EPROM), electrically erasableprogrammable read-only memory (EEPROM), and flash memory. For ease ofexplanation, the sector management system is described below in terms ofthe local hard disk embodiments.

The sector management system as described herein utilizes a table, forexample, a matrix table or a file allocation table (FAT), for thestorage and retrieval of sector state data. However, in otherembodiments, the sector management system may utilize different ways ofstoring and retrieving sector state data, for example, using analgorithmic approach, static or dynamic linking techniques, or othertypes of tables or data storage schemes for storing and retrievingsector state data. The table for storing the sector state may be storedon any of a number of storage devices, for example, a mass storagedevice such as a hard drive, a memory device, or even split acrossmultiple devices, such as a Redundant Array of Independent Disks (RAID)system.

As used herein, the terms memory state, recovery data, recovery point,recovery state, sector state, configuration, system or softwareconfiguration, or personal computer (PC) state, may be used essentiallyinterchangeably herein to refer to the data associated with a particularstate, configuration or status of the computer system or storage device.In some embodiments, the recovery point may include the operating systemof the computer system, and the operating system may have storagetables, for example, a file allocation table (FAT), which refers to atable the operating system uses to locate files on a disk device. Thus,each recovery point or sector state can itself act as a separate andindependent operating system.

In other embodiments, recovery points represent system or softwareconfigurations. System or software configurations can refer to versionsof the operating system, operating environment, application softwareprograms, utility software programs, or data used by any of these. Theseembodiments are described below following the description of thefigures.

While the systems and methods described herein have many manners of useand implementation, the following describes various embodiments in termsof a recovery system for illustrative purposes only. However, as wouldbe understood by those skilled in the technology, other embodiments ofthe sector management system, for example, restoration or reversionsystems, configuration management systems, and security systems, couldalso be implemented using the systems and methods as described herein.

FIG. 1 is a block diagram illustrating embodiments of the components ormodules of a computer system 10 with a sector management system 150.However, it should be understood that modules represented herein assoftware may also be implemented as hardware, for example, as anapplication-specific integrated circuit (ASIC). The computer system 10may be one of a number of microprocessor or processor controlleddevices, for example, personal computers, workstations, servers,clients, mini computers, main-frame computers, laptop computers, anetwork of individual computers, mobile computers, palm-top computers,hand-held computers, set top boxes for a television, other types ofweb-enabled televisions, interactive kiosks, personal digitalassistants, interactive or web-enabled wireless communications devices,mobile web browsers, or a combination thereof. The computers may furtherpossess input devices such as a keyboard, mouse, touchpad, touch screen,joystick, pen-input-pad, and the like. The computers may also possess anoutput device, such as a screen or other visual conveyance means and aspeaker or other type of audio conveyance means.

The computer system 10 is generally controlled by an operating system100, such as DOS, Windows, Macintosh OS, OS/2, Linux, or others. A keypart of many operating systems 100 is a file system 102, with which theoperating system 100 manages and stores files. Files refer not only touser data, but also to any of the files on the computer including, forexample, program files and configuration files. Examples of file systems102 include FAT16, FAT32 and Microsoft NT file system (NTFS). Generallythe file system 102 has an index 104 to track the locations of files inthe memory of the computer system. For example, the FAT16 and the FAT32file systems use the file allocation table (FAT) to keep track of files.

The operating system 100 may also include one or more device drivers,collectively identified as 106 in FIG. 1, which enable communicationwith hardware devices, such as a hard disk 114. One example of a devicedriver is the real mode input/output (I/O) driver 108 (IO.SYS) in DOSand DOS-based versions of Windows. The real mode I/O driver 108generally relies on the BIOS (basic input/output system) 110 tocommunicate with the hard disk 114, as explained below. The BIOS 110handles read and write requests to the hard disk 114.

Another component of the system shown in FIG. 1 is the hard disk 114.While embodiments as shown in FIG. 1 illustrate the hard disk 114 beinglocated internal to the computer system 10 from which the recovery pointstorage or retrieval is being initiated, other embodiments may beutilized in which the hard disk 114 is located external to the computersystem 10. As an example, the hard disk 114 may alternatively be astorage device that is located on another computer system that isaccessible via a computer network 30. The network 30 could be, forexample, an Ethernet network in which distributed servers having a harddisk or other storage device are connected to the network 30, and areaccessible to the other devices on the network. Thus, storage andretrieval of recovery data, as described in detail below, could bedirected to a local storage device, such as the hard disk 114 (as shownin FIG. 1), or to a remote storage device (not shown) accessible via thenetwork 30.

The network 30 may implement virtual private network (VPN) capabilities.A VPN can be a secure and encrypted communications link between nodes ona network, for example, the Internet, a Wide Area Network (WAN), a LocalArea Network (LAN), or an Intranet. These nodes can communicate witheach other. However, it is very difficult for an unauthorized user, forexample, a hacker, to either comprehend the meaning of the signals orsend signals that are believed to be authentic. One securecommunications technology that is designed to facilitate a VPN is SecureSockets Layer (SSL). Other secure communications technologies can beused as well.

A VPN can operate between a number of internet-enabled devices. Forexample, a VPN can run on two or more PCs that are connected togetherusing various security technologies. In other embodiments, a VPN canoperate between a PC and a website using security technologies. Infurther embodiments, a VPN can additionally operate between many PCsand/or many websites. For example, hand-held devices such as personaldigital assistants (PDAs), wireless devices such as mobile or cellphones, web-enabled TV sets can also be used as client devices insteadof PCs as part of the VPN.

In some computer systems, the smallest addressable unit on the hard disk114 is the sector. However, in both FAT16 and FAT32, two very commonfile systems 102, the smallest addressable memory allocation unit on ahard disk is the cluster, which is an integer multiple number ofsectors. In an operating system 100 with such file systems, the realmode I/O driver 108 also functions in units of clusters. In the FAT16and FAT32 file systems, each file is stored in one or more clusters,with each file occupying an integer multiple number of clusters. Thefile system 102 tracks the location of each file by noting the addressof the first cluster storing a file (e.g., the starting cluster) in itsindex 104 (FAT). If a file is larger than one cluster, thus occupyingmore than one cluster, a pointer is provided at the end of each cluster,except the last one, pointing to the next cluster in which part of thefile is stored. In still other embodiments, other addressable unitsbesides clusters and sectQrs are utilized, and such embodiments are alsowithin the scope of the present invention.

The computer system 10 may be connected to the computer network 30, ormay alternatively operate in a standalone mode without being connectedto a network. The computer network is a type of computer communicationlink or combination of computer communication links spanning anygeographical area, such as a local area network, wide area network,regional network, national network, global network, or any combinationof these types of networks. These terms may refer to hardwire networks,wireless networks, dial-up networks, or a combination of these or othernetworks. Hardwire networks may include, for example, fiber optic lines,cable lines, ISDN lines, copper lines, etc. Wireless networks mayinclude, for example, cellular systems, personal communication services(PCS) systems, satellite communication systems, packet radio systems,and mobile broadband systems.

Through the computer network 30, the computer system 10 is able toexchange data with other computer systems that are additionallyconnected to the computer network 30, as shown by the computer system 20in FIG. 1. While FIG. 1 shows only two computer systems 10, 20 connectedto the computer network 30, additional computer systems may also beconnected to the computer network 30 to which communication links may beestablished for the exchange of data. The additional computer systems onthe network 30, such as the computer system 20 shown in FIG. 1, may beconfigured similar to the computer system 10 as illustrated in FIG. 1,or may be configured differently, for example, without some or all ofthe sector management system 150 components.

In some embodiments, one or more enterprise manager modules orcomponents may execute on any node on the network 30, such as thecomputer system 20. The manager capability may be utilized in anorganization with computers connected to a network, often referred to asan enterprise computing system. An Intranet, a network used to shareinformation within an organization accessible only by those within theorganization or others with authorization, is one example of anenterprise computing system. The enterprise manager modules include thecapability to initiate the storage or retrieval of sector statesremotely. For example, the enterprise manager modules executing on thecomputer system 20 are able to initiate the storage or retrieval ofstates of the computer system 10 via data communicated over the network30. Thus, using the example of FIG. 1, a computer system 10 that hasbecome non-operational may be remotely restored to an operational stateby someone, for example, Information Technology (IT) personnel, from thecomputer system 20. In other embodiments, the enterprise manager modulescontrol and initiate the storage or retrieval of sector states on amultitude of computer systems 10 that are connected to the network 30.

The enterprise manager may additionally include the capability tomonitor statistics regarding the storage or retrieval of sector stateson multiple remote computer systems that are connected to the network30. For example, such statistical data may include when recovery stateswere saved, when computer systems were restored to previously savedstates, or the number of storage or retrieval operations that have beenperformed on a computer by computer basis. Execution of the enterprisemanager is optional, however, as the sector management system is fullycapable of standalone operation, whether or not the computer system isconnected to a network.

FIG. 2 is a diagram illustrating the relationship between files,clusters and sectors in a file system 102 such as FAT16 or FAT32. Inthis example, each cluster is formed of 8 sectors. While the file inthis example may only require 19 sectors (represented by the verticaldash line) to store, it occupies 3 clusters because the cluster is thesmallest addressable file allocation unit in the file system 102. Thearrows from the end of one cluster to the next indicate that the file iscontinued in the next cluster. Another way to look at this is that instoring this file on the hard disk, only sectors 1-19 of the hard disk114 are written to, or used, while sectors 20-24 are free. However,while sectors 20-24 are free, the file system 102 is only able toaddress sectors 17-24 together as cluster 3. The file system 102indicates that clusters 1-3 are already used to store a file, and thuscluster 3 is unavailable for the storage of another file. (The filesystem 102 as described above cannot read the hard disk 114 at thesector level.) Thus sectors 20-24 represent wasted space, usually calledslack.

Referring again to FIG. 1, a hard disk controller 112 is the hardwareinterface to the hard disk 114. The hard disk controller 112 manages thetransfer of information to and from the hard disk 114. ATA (advancedtechnology attachment) also know as DE (integrated drive electronics),SCSI (small computer systems interface) and USB (universal serial bus)are examples of interfaces that can be employed as the interface betweenthe hard disk controller and the computer. One or more hard diskcontrollers 112 are often integrated into many motherboard chipsets, forexample, those developed by Intel and AMD.

Because of the difference in addressable units between, for example, theFAT16 and FAT32 file systems 102 (clusters) and the hard disk 114(sectors), communications between the operating system 100 and the harddisk 114 are often translated. In an example system, this translation isperformed by the BIOS 110. In one example, the real mode I/O driver 108uses interrupt 13 h (Int 13 h) to call the BIOS 110. Using the BIOS 110to translate between the operating system 100 and the hard disk 114incurs a performance cost. It also requires the use of the real mode I/Odriver 108, decreasing operating system stability. In DOS and earlierDOS-based versions of Windows, such as Windows 3.x and Windows 95, thereal mode I/O driver 108 is used to communicate with the hard disk 114,thus necessitating the use of the BIOS 110 for the aforementionedtranslation.

Thus a more recent operating system 100, such as Windows NT and 2000,may use a protected mode hard disk controller driver 116 to communicatewith the hard disk 114, without the need to use the BIOS 110. Theprotected mode hard disk controller driver 116 is usually specific tothe hard disk controller 112 in the computer, and is able to address thehard disk 114 at the sector level. ATA and SCSI hard disk controllers112, for example, are also dedicated controllers optimized tocommunicate with storage devices. In more recent Windows operatingsystems, e.g., Windows NT and 2000, the protected mode hard diskcontroller driver 116 loads towards the beginning of the boot process,and communication with the hard disk 114 is handled entirely by thisdriver.

In some other intermediate operating systems 100, such as laterDOS-based versions of Windows, including Windows 95OSR2, 98, 98SE andMe, a real mode I/O driver 108 is used to communicate with the hard disk114 while the operating system 100 is loading during the boot process ofthe computer. Thus the BIOS 110 may be used to translate communicationbetween the real mode I/O driver 108 and the hard disk 114. A protectedmode hard disk controller driver 116 is loaded with the operating system100. After the loading of the protected mode hard disk controller driver116, it takes over the communication with the hard disk 114, and thereal mode I/O driver 108 and the BIOS 110 are no longer used tocommunicate with the hard disk 114.

In certain embodiments, the sector management system BIOS filter module118 intercepts read and write requests from the real mode I/O driver 108to the BIOS 110, for example, by intercepting interrupt 13 h calls fromthe real mode I/O driver 108 to the BIOS 110. The BIOS filter 118 may beimplemented as a terminate-&-stay-resident (TSR) program. Theseembodiments may be used with DOS and earlier DOS-based versions ofWindows, such as Windows 3.x, Windows 95 and similar systems.

In other embodiments, the sector management system device driver module120 intercepts read and write requests from the protected mode hard diskcontroller driver 116 to the hard disk controller 112. This embodimentmay be used with Windows NT and 2000 and similar systems.

In still further embodiments, the BIOS filter 118 intercepts read andwrite requests from the real mode I/O driver 108 to the BIOS 110, forexample, while the operating system 100 is loading during the bootprocess of the computer. The device driver 120 intercepts read and writerequests from the protected mode hard disk controller driver 116 to thehard disk controller 112, for example, after the operating system 100has loaded. These embodiments may be used with later DOS-based versionsof Windows, such as Windows 95OSR2, 98, 98SE and Me and similar systems.

In some embodiments, intercepted write requests, whether interrupted bythe device driver 120 or the BIOS filter 118, are passed to aWrites_Module 124. Similarly, intercepted read requests are passed to aReads_Module 126. The Writes_Module 124 and the Reads_Module 126 mayredirect write and read requests to certain sectors, respectively,depending on the flags of the target sectors in matrix table(s) 122.Although illustrated in the embodiment of FIG. 1 as a matrix table 122,other embodiments utilize different ways of storing and retrievingsector data, for example, using an algorithm to generate pointerinformation, static or dynamic linking techniques, or the like. Forexample, sector data may be input to an algorithm that produces one ormore tables corresponding to one or more recovery points as appropriatefor the sector data. Redirecting of reads and writes to sectors ofmemory storage, for example, to perform read and recover operations, canthus be accomplished in multiple ways.

The sector management system 150 also includes an Identify_Module 128and a Recover_Module 130. The Writes_Module 124, the Reads_Module 126,the Identify_Module 128 and the Recover_Module 130 all interact with thematrix table(s) 122, as discussed in further detail below.

The functions described herein for the RS BIOS filter 118, the RS devicedriver 120, the Writes_Module 124, the Reads_Module 126, theIdentify_Module 128 and the Recover_Module 130, may also be implementedby other components in other embodiments of the sector management system150. For example, the sector management system 150 can be built into theBIOS 110, or implemented in the logic of the hard disk controller 112 orin the code of the protected mode hard disk controller driver 116.

Although described in reference to the embodiment illustrated in FIG. 1and utilizing the Windows operating systems and their associated devicedrivers and hardware implementations, the systems and methods describedherein may be implemented in numerous other embodiments utilizingvarious other operating systems and hardware configurations. Forexample, in certain embodiments the systems and methods may beincorporated into the operating system, e.g., Windows. In suchembodiments, the system and method are integrated into and are part ofthe normal write and read flow of the operating system. In addition, thematrix table may be integrated into and be part of the FAT file systemdata. Still other embodiments are also possible, and are considered tobe within the scope of the present invention. For example, certainembodiments maintain the recovery data in other types of tables beside amatrix table, or organized in other ways besides in a table format.

FIG. 3 is a diagram illustrating a simplified representation of 12sectors, labeled A-L, of a hard disk. Though the sectors are shown inthis simplified representation as being physically contiguous, that isnot necessarily so in the hard disk. In addition, sectors A-L do not allneed to be located physically on one hard disk or memory device. Forexample, they can be located in multiple locations such as on RAID(redundant array of independent disks) devices or spread across avariety of memory devices. The first four sectors, A-D, are used, whichis represented by shading. The next eight sectors, E-L, are free. A“used” sector refers to a sector in which useful or valid data isstored. A “free” sector refers to a sector in which no useful data iscurrently stored. A free sector can be a sector that is actually blank,or a sector in which the data is no longer accessible. For example, whena file is deleted by the file system 102 such as FAT16 or FAT32, itscorresponding entry in the FAT may be simply deleted, without actuallyerasing the data from the sectors if occupies. While the data in thesectors may remain, the sectors appear to be free because the clustersthey belong to are not associated with an entry in the FAT.

FIG. 4 is a diagram illustrating the sectors of FIG. 3 after theIdentify_Module 128 has identified a set of recovery data. The set ofrecovery data reflects the state or contents of the memory at the pointin time at which the set of recovery data was identified. The point intime at which a set of recovery data or a recovery state is identifiedis alternatively referred to as a recovery point, sector state, memorystate, system state, computer state, or personal computer (PC) state.Accordingly, these terms are generally synonymous as used herein and maybe substituted for one another while maintaining consistent meaning andexplanation. Thus recovery point 1 refers to the point in time at whichrecovery data set 1 was identified. The set of recovery data isidentified so that the sector management system 150 can recover (orrestore) the memory to that state at a later time. In FIG. 4 the firstset of recovery data is located in the sectors A-D which are to the leftof the vertical line between sectors D and E. In this example, the setof recovery data includes data in sectors that are already in use whenthe set of recovery data is identified. In this example sectors A-D arethe sectors in use that contain the first set of recovery data, e.g.,recovery data set 1. For ease of discussion, sectors A-D are representedas being contiguous, or adjacent to each other, and thus the identifiedrecovery data, recovery data set 1, can be delineated by a vertical linewhich separates the sectors containing the recovery data, sectors A-D,from the other sectors E-L. Of course, the sectors containing the set ofrecovery data do not have to be contiguous or adjacent. The sectormanagement system 150 may allow the user to create a recovery point. Thesector management system 150 may also be configured to automaticallycreate a recovery point periodically, for example, for a weekly backup.The sector management system 150 may also be triggered by certain eventsto create a recovery point, for example, after a scandisk operationfinds a bad cluster.

FIG. 5 is a diagram illustrating a representation of a matrix table,e.g., matrix table 1, associated with the recovery data set 1 discussedabove with regard to FIG. 4. In some embodiments, the Identify_Module128 creates a matrix table for each set of recovery data. After theIdentify_Module 128 creates the matrix table 122, it saves a copy of thematrix table as an original version. Subsequent changes to the matrixtable are saved in a working version. The sector management system 150uses one or more matrix tables to track the status or state of sectors.The matrix table(s) can be located in protected sections on the harddisk or memory. Alternatively they can be stored in other locations, forexample, a dedicated area on the hard disk, and on other memory devices,for example, a flash memory USB dongle (a device that attaches to acomputer to control access to a particular application is often referredto as a dongle). In this embodiment, the matrix table tracks six typesof sector status defined as follows:

-   1. Already_Used (AU)—Sectors already used before the sector    management system 150 identifies recovery data at a recovery point.-   2. RS_Free (RSF)—Sectors that are actually free, as determined by    the sector management system 150.-   3. RS_Used (RSU)—Sectors used by the sector management system 150 to    store new data that would otherwise overwrite data in protected    sectors.-   4. Newly_Used (NU)—Sectors used to store new data that would not    overwrite data in protected sectors.-   5. Current_Redirected (CR)—Sectors redirected to other sectors.-   6. Previous_Redirected (PR)—Similar to Current_Redirected, but used    when there is more than one recovery point. The creation of more    recovery points is discussed in further detail below.

The sectors of the hard disk 114 or other memory are identified as beingone of the six status types in the matrix table 122. In someembodiments, the matrix table 122 needs only to explicitly track five ofthe six status types of sectors, while the sixth status type is derivedfrom the other five via a process of elimination. In still furtherembodiments, fewer or greater numbers of status types may be used, andthese embodiments are also within the scope of the present invention.However, the discussion is more easily followed if the embodimentutilizing six status types is discussed.

In certain embodiments, a new matrix table is created for every set ofrecovery data or recovery point. A copy of each newly created matrixtable is saved as the original version to represent the state of thehard disk 114 at that recovery point. The original version of the matrixtable 122 is used to recover to the corresponding recovery point, asdiscussed in further detail below. As write requests are redirected andsector status type flags are changed after the identification ofrecovery data, these changes are saved to the working version of thematrix table 122. While the two versions of the matrix table 122 may beconceptualized as separate tables, the working version may berepresented as a list of changes to the original version. Theinformation stored in the matrix tables 122 does not necessarily have tobe stored in a matrix table for each recovery point. In otherembodiments, for example, all the redirections and changes to sectorstatus type flags from multiple recovery points can be stored together,as long as the information associated with each recovery point can bedelineated from the information associated with other recovery points.

As write requests are intercepted and redirected to other sectors, thesectors that appear to the file system as free (those belonging to freeclusters) may have actually been used by the sector management system150, e.g., to store redirected write requests. Thus the sectormanagement system 150 tracks via the matrix table sectors that areactually free with the status type flag RS_Free. In other embodiments inwhich the present systems and methods are integrated into the operatingsystem, the write requests are more aptly described as being part of thenormal write flow of the operating system rather than being interceptedas described above.

Referring again to FIG. 1, the file system 102 generates a write requestdirected at one or more clusters. The write request is translated andexpressed in sectors by either the BIOS 110 or the protected mode harddisk controller driver 120. The translated write requests areintercepted (or trapped) in certain embodiments by the RS BIOS filter118 or, alternatively, by the RS device driver 120, before they reachthe hard disk 114. The Writes_Module 124 of the sector management system150 processes the intercepted write requests.

In connection with the embodiments of FIGS. 6-10 as described below, theprocessing of write requests by the sector management system 150 arediscussed in detail. The left columns in those figures are flowchartsrepresenting the process or steps. The middle columns show changes tothe matrix table associated with the steps. The right columns illustrategraphical representations of the 12 example hard disk sectors shown inFIG. 3.

FIG. 6 is a diagram illustrating an embodiment of a process, matrixtables and sector representations associated with a write request fromthe file system 102 to a sector flagged as Already_Used. In step 600 theRS BIOS filter 118 or the RS device driver 120 intercepts a writerequest to sector A. As was noted above with regard to FIG. 1, the writerequest can be intercepted, for example, via BIOS Int 13 h (RS BIOSfilter 118) or by intercepting the write request from the protected modehard disk controller driver 116 (RS device driver 120). In otherembodiments in which the present systems and methods are integrated intothe operating system, the write requests are more aptly described asbeing part of the normal write flow of the operating system rather thanbeing intercepted as described above. In step 602 sector A is determinedto be flagged as Already_Used by reference to matrix table 1. At thispoint the original version and the working version of matrix table 1 arethe same, as there has not been any changes yet. In step 604 theWrites_Module 124 finds a sector that is flagged as RS_Free from theworking version of matrix table 1, e.g., sector E. Sector E is thenflagged as RS_Used in the working version of matrix table 1 in step 606.In step 608 the data contained in the write request of step 600 iswritten to sector E. In step 610 sector A is flagged asCurrent_Redirected in the working version of matrix table 1. In step 612the redirection from sector A to sector E is updated in the workingversion of matrix table 1 to represent that the current data of sector Ais in sector E. While the last four steps, steps 606-612, areillustrated in a particular order, they may actually be carried out inany order. The foregoing steps or process protect the data in sector Afrom being overwritten while allowing the computer system to operate asif sector A had been overwritten. This can enable the sector managementsystem 150 to be transparent to the file system 102.

FIG. 7 is a diagram illustrating an embodiment of a process, matrixtables and sector representations associated with a write request fromthe file system 102 to a sector flagged as RS_Free. In step 700, in thesame manner as described above in connection with step 600, a writerequest to sector F is intercepted. In step 702 the Writes_Module 124refers to the working version of matrix table 1 and determines thatsector F is flagged as RS_Free. In step 704 sector F is flagged asNewly_Used in the working version of matrix table 1. In step 706′ thedata contained in the write request of step 700 is written to sector F.The last two steps, steps 704 and 706, may be carried out in reverseorder. Write requests to RS_Free sectors do not have to be redirectedbecause no protected data, that is, data contained in sectors identifiedas recovery data set 1, are being overwritten.

FIG. 8 is a diagram illustrating an embodiment of a process, matrixtables and sector representations associated with a write request fromfile system 102 to a sector flagged as RS_Used. In step 800 a writerequest to sector E is intercepted in the manner described above. Notethat as discussed above, while the file system 102 may see sector E as afree sector, it is actually in use to store redirected data that wouldhave otherwise overwritten sector A. In step 802 the Writes_Module 124refers to the working version of matrix table 1 and determines thatsector E is flagged as RS_Used. In step 804 the Writes_Module 124 findsa sector that is flagged as RS_Free from the working version of matrixtable 1, e.g., sector G. Sector G is then flagged as RS_Used in theworking version of matrix table 1 in step 806. In step 808 the datacontained in the write request of step 800 is written to sector G. Instep 810 sector E is flagged as Current_Redirected in the workingversion of matrix table 1. In step 812 the redirection from sector E tosector G is updated in the working version of matrix table 1. While thelast four steps, steps 806-812, are illustrated in a particular order,they may actually be carried out in any order. As discussed above,RS_Used sectors are used by the sector management system 150 to storedata that would have otherwise overwritten protected sectors, or sectorsidentified as containing data belonging to a recovery data set. Thuswrite requests to RS_Used sectors are redirected, to preserve the datatherein. Subsequent write requests to sector E are also redirected tosector G. Sector G appears transparently to the file system as sector E.

FIG. 9 is a diagram illustrating an embodiment of a process, matrixtables and sector representations associated with a write request fromthe file system 102 to a sector flagged as Newly_Used. In step 900 awrite request to sector F is intercepted in the manner described above.In step 902 the Writes_Module 124 refers to the working version ofmatrix table 1 and determines that sector F is flagged as Newly_Used. Instep 904 the data contained in the write request of step 900 is writtento sector F. Because sector F did not contain data to be protected, assector F was not in use before recovery data set 1 was identified atrecovery point 1, the sector management system 150 allows sector F to beoverwritten.

FIG. 10 is a diagram illustrating an embodiment of a process, matrixtables and sector representations associated with a write request fromfile system 102 to a sector flagged as Current_Redirected. In step 1000a write request to sector A is intercepted in the manner describedabove. In step 1002 the Writes_Module 124 refers to the working versionof matrix table 1 and determines that sector A is flagged asCurrent_Redirected. In step 1004 the Writes_Module 124 determines fromthe working version of matrix table 1 the sector to which sector A isredirected, sector E. In step 1006 the data contained in the writerequest of step 1000 is written to sector E. Although sector E is itselfredirected to sector G, a write request to sector A is redirected tosector E. A write request directly to sector E will be redirected tosector G. Sector E appears transparently to the file system 102 assector A. Sector G also appears transparently to the file system assector E, as discussed above.

Thus the data contained in sectors A-D are not overwritten after theyare identified as containing data belonging to recovery data set 1 atrecovery point 1. However, the computer system can operate as if theyhad been overwritten while preserving them for recovery purposes,because the redirections can be transparent to the file system.

The sector management system 150 also process read requests. Readrequests are intercepted in the same manner as write requests by the RSBIOS filter 118 and the RS device driver 120 as discussed above. In someembodiments, the read requests from the file system 102 intercepted bythe RS BIOS filter 118 or the RS device driver 120 can be processed by aReads_Module 126. In other embodiments in which the present systems andmethods are integrated into the operating system, the read requests, aswell as the write requests, are more aptly described as being part ofthe normal read flow of the operating system rather than beingintercepted as described above. The Reads_Module 126 redirects readrequests to some sectors depending on their status flags in the matrixtable associated with the current recovery point. Basically, all sectorsare read directly, except those sectors flagged as Current_Redirected orPrevious_Redirected. Read requests to these sectors are redirectedaccording to its entry in the current matrix table. Previous_Redirectedsectors will be discussed in further detail below with regard tosubsequently identified recovery data sets at later recovery points.

FIG. 11 is a diagram illustrating a representation of the aforementioned12 sectors that indicates a new recovery data set, e.g., recovery dataset 2, identified at a new recovery point, e.g., recovery point 2. Asdiscussed above, in some embodiments of the invention, theIdentify_Module 128 identifies a new set of recovery data, recovery dataset 2, at recovery point 2, and creates the corresponding matrix table2. The processes now described follow the example discussed in FIGS.6-10. The recovery data identified as recovery data set 2 at recoverypoint 2 is stored in the sectors to the left of the vertical linebetween sectors G and H. At recovery point 2, sectors A-G are in use,while sectors H-L are free.

FIG. 12 is a diagram illustrating an embodiment of a second matrixtable, e.g., matrix table 2, corresponding to recovery data set 2 ofFIG. 11. The Identify_Module 128 creates the original version of matrixtable 2 from the working version of matrix table 1 with the followingalgorithm:

Flag in previous matrix table: Flag in new matrix table: 1. Already_UsedAlready_Used (unchanged) 2. RS_Free RS_Free (unchanged) 3. RS_UsedRS_Used (unchanged) 4. Newly_Used Already_Used 5. Current_RedirectedPrevious_Redirected 6. Previous_Redirected Previous_Redirected(unchanged)

Sectors that are flagged as Already_Used, RS_Free, RS_Used andPrevious_Redirected in the working version of matrix table 1 remainunchanged in the original version of matrix table 2. Sectors flagged asNewly_Used in the working version of matrix table 1 are flagged asAlready_Used in the original version of matrix table 2. For example,sector F is flagged as Already_Used in the original version of matrixtable 2 because, at recovery point 2, sector F contains useful datawritten after the identification of recovery data set 1 and must also beprotected. Sectors flagged as Current_Redirected in the working versionof matrix table 1 are flagged as Previous_Redirected in the originalversion of matrix table 2. For example, sector A and its target sector E(represented as A=>E) are flagged as Previous_Redirected in the originalversion of matrix table 2, because a write request to sector A after theidentification of recovery data set 2 should not be redirected to sectorE, as sector E saves the data in sector A before the identification ofrecovery data set 2. This is discussed in more detail below. These stepsensure that the original version of matrix table 2 reflects theconditions of the hard disk sectors at recovery point 2.

Write requests to sectors marked as Already_Used, RS_Free, RS_Used,Newly_Used, and Current_Redirected have already been discussed withrespect to matrix table 1 in FIGS. 6-10. Write requests from the filesystem 102 to these types of sectors after the identification ofrecovery data set 2 are handled in the same manner as was described withrespect to FIGS. 6-10 using the working version of matrix table 2. Oncea new matrix table is created, e.g., matrix table 2, reference isusually only made to an earlier matrix table, e.g. matrix table 1, whenrestoring the hard disk to the state reflected by the recovery data setassociated with that earlier table. Therefore, the working version ofmatrix table 1 can be discarded and only the original version of matrixtable 1 needs to be retained, for example, for recovery or restorepurposes.

FIG. 13 is a diagram illustrating an embodiment of a process, matrixtables and sector representations associated with a write request fromfile system 102 to a sector flagged as Previous_Redirected, with respectto matrix table 2 shown in FIG. 12. At this point, the contents of boththe original and the working versions of matrix table 2 are identical.In step 1300 a write request from the file system 102 to sector A isintercepted in the manner described above. In step 1302 theWrites_Module 124 determines from the working version of matrix table 2that sector A is flagged as Previous_Redirected. In step 1304 theWrites_Module 124 finds a sector from the working version of matrixtable 2 that is flagged as RS_Free, e.g., sector H. Sector H is thenflagged as RS_Used in the working version of matrix table 2 in step1306. In step 1308 the data contained in the write request of step 1300is written to sector H. In step 1310 sector A is flagged asCurrent_Redirected in the working version of matrix table 2. In step1312 the redirection from sector A to sector H is updated in the workingversion of matrix table 2. While the last four steps, steps 1306-1312,are illustrated in a particular order, they may actually be carried outin any order. Further read and write requests to sector A are alsoredirected to sector H.

FIG. 14 is a diagram illustrating a representation of the 12 hard disksectors with two identified recovery data sets. Recovery data set 1includes the sectors to the left of line 1, and recovery data set 2includes the sectors to the left of line 2. As sector H is now flaggedas RS_Used, a write request from the file system 102 to sector H ishandled just like the write request to sector E as described withrespect to FIG. 8. A write request from the file system 102 to sector His redirected by the Writes_Module 124 to sector I, as sector H isflagged as RS_Used in the working version of matrix table 2. This isrepresented by the arrow from sector H to sector I in FIG. 14.

FIG. 15 is a diagram illustrating an embodiment of the correspondingchanges to the working version of matrix table 2 made by theWrites_Module 124 after redirecting to sector I a write request from thefile system to sector H as discussed above with regard to FIG. 14. H isflagged as Current_Redirected and sector I is flagged as RS_Used in theworking version of matrix table 2.

FIG. 16 is a diagram illustrating a representation of a new recoverydata set, e.g., recovery data set 3, identified by the Identify_Module128 at recovery point 3. Recovery data set 3 is delineated by thevertical line, line 3, between sectors I and J. FIG. 17 is a diagramillustrating an embodiment of a new matrix table, e.g., matrix table 3,created by the Identify_Module 128. Matrix table 3 is created using theprocess described above with respect to FIG. 12. Again, a copy of thematrix table 3 is saved as an original version, and the Writes_Module124 and the Reads_Module 125 make changes to the working version ofmatrix table 3.

FIG. 16 represents the 12 hard disk sectors, A-L, after theIdentify_Module has identified recovery data set 3 at recovery point 3.The corresponding new matrix table, matrix table 3, is illustrated inFIG. 17. The process of identifying a recovery data set and creating acorresponding new matrix table is discussed above with regard to FIG.12. Once again, only sectors that are flagged as either Newly_Used orCurrent_Redirected are reflagged in the new matrix table, matrix table3. There are no Newly_Used sectors in the working version of matrixtable 2. The two Current_Redirected sectors in matrix table 2, A and H,are reflagged as Previous_Redirected in matrix table 3. Again, afterthese changes are made, an original copy of matrix table 3 is saved andthe working version is used by the Writes_Module 124.

FIG. 18 is a diagram illustrating a further representation of the 12hard disk sectors with three identified recovery data sets. A writerequest from the file system 102 to sector J is represented by thehollow arrow on top of sector J. Write requests from the file system 102to RS_Free sectors have already been discussed above with regard to FIG.7. At this point, the contents of both the original and the workingversions of matrix table 3 are identical. The Writes_Module 124determines that sector J is flagged as RS_Free in matrix table 3 (asshown in FIG. 17), writes the data to sector J, and changes its flag toNewly_Used in the working version of matrix table 3. (as shown in FIG.19).

FIG. 19 is a diagram illustrating an embodiment of a representation ofthe working version of matrix table 3 after the Writes_Module 124processes the write request to sector J. As discussed above with regardto FIG. 18, the Writes_Module 124 has changed the flag of sector J fromRS_Free to Newly_Used in the working version of matrix table 3.

Restoring the hard disk to a state reflected by the data in a previouslyidentified recovery data set will now be discussed. In certainembodiments, referring back to FIG. 1, the recovery algorithm can beimplemented in and performed by a Recover_Module 130. Three sets ofrecovery data, recovery data sets 1-3, have been identified at recoverypoints 1-3, respectively, in the embodiments described thus far. Inother embodiments, the Recover_Module 130 restores the hard disk to astate reflected by a previously identified recovery data set byidentifying a new recovery data set and creating a corresponding newmatrix table.

FIG. 20 is a diagram illustrating an embodiment of an overview of thenewly identified recovery data set, e.g., recovery data set 4. Recoverydata set 4 is identified at recovery point 4. At recovery point 4,sectors A-J are in use. These sectors are delineated by the verticalline marked 4(1). The (1) denotes that the sector management system 150is restoring the hard disk to the state reflected by recovery data set1.

FIG. 21 is a flowchart illustrating an embodiment of a process performedby the Recover_Module 130 to restore the hard disk to a state reflectedby a previously identified recovery data set. In step 2100 theRecover_Module 130 identifies a new recovery data set n to restore thehard disk to the state reflected by a previously identified recoverydata set al. In step 2102, the Recover_Module 130 creates the originalversion of the corresponding matrix table n by copying the originalversion of matrix table a. As discussed above, the original versionrefers to the contents of the matrix table, which reflects the state ofthe hard disk sectors at the identification of its correspondingrecovery data set. In step 2104, the Recover_Module 130 compares theRS_Free sectors in matrix table n to the RS_Free sectors in the workingversion of matrix table n−1, the matrix table reflecting thethen-current state of the hard disk. In step 2106, each RS_Free sectorin matrix table n that is not also flagged as RS_Free in working versionof matrix table n−1 is reflagged as Already_Used in matrix table n bythe Recover_Module 130, because that means that such sector is actuallyin use.

FIG. 22 is a diagram illustrating in greater detail an embodiment of aprocess, matrix tables and sector representations associated with theembodiment shown in FIG. 20, with the Recover_Module 130 performing theprocess as discussed above with regard to FIG. 21. As in FIG. 20, theRecover_Module 130 identifies recovery data set 4 to restore the harddisk to the state reflected by recovery data set 1 in step 2200.Recovery data set 4 is delineated by the vertical line between sectors Jand K, designated 4(1). In step 2202, the Recover_Module 130 creates theoriginal version of matrix table 4 by copying the original version ofmatrix table 1. In the graphical representation of the 12 sectors in therightmost column, sectors E-J lose the gray shading which indicates asector in use, as they are flagged as RS_Free in the working version ofmatrix table 4. In step 2204, the Recover_Module 130 compares theRS_Free sectors in the working version of matrix table 4 to the RS_Freesectors in the working version of matrix table 3. (The working versionof matrix table 3 is derived from FIG. 19.) In step 2206, each RS_Freesector in the working version of matrix table 4 that is not also flaggedas RS_Free in matrix table 3 is reflagged as Already_Used in the workingversion of matrix table 4 by the Recover_Module 130. These are sectorsE-J. Sectors E-J have already been used before the identification ofrecovery data set 4, and are not actually free. Once again, after theRecover_Module 130 creates the original version of matrix table 4 andperforms the comparison against the working version of the previousmatrix table (as well as any necessary changes), it saves the originalversion of matrix table 4, which reflects the state of the hard disk atthe point in time at which recovery data set 4 is identified. If thereare any further changes to the hard disk, the resulting changes areupdated in the working version of matrix table 4.

Creating a new recovery point to recover to a previous recovery pointuses more sectors than just going backwards to the target recoverypoint, canceling the redirection of redirected sectors, and deleting thenow unnecessary sectors. However, creating a new recovery point torecover to a previous recovery point allows the redirections created inall the recovery points to be saved. This enables the sector managementsystem 150 to restore to a later recovery point without any loss ininformation, e.g., restoring to recovery point 3 after recovering torecovery point 1. Restoring and recovering refer to going from anearlier recovery point to a later recovery point, as well as going froma later recovery point to an earlier recovery point. Therefore, whilethe systems and methods described herein generally refer to restoring asbeing from an earlier recovery point to a later recovery point, andrecovering as being from a later recovery point to an earlier recoverypoint, this is for illustrative purposes only. Both restoring andrecovering refer to altering the state or configuration of a computersystem to a saved state or configuration, and thus do not necessarilyhave any chronological limitations.

FIG. 23 is a diagram illustrating an embodiment of a process, matrixtables and sector representations in which the Recover_Module 130creates recovery point 5 to restore to recovery point 3 after creatingrecovery point 4 to recover to recovery point 1 as shown in FIG. 22.Conceptually, there is only a semantic difference between restoring andrecovering, as recovery point 5 can be thought of as being created torecover to recovery point 3. In step 2300, the Recover_Module 130creates recovery point 5 to recover to recovery point 3. This isrepresented by the vertical line between sectors J and K, designatedrecovery point 5(3). As the sector management system 150 has made nochanges to matrix table 4 before the creation of matrix table 5,recovery point 5 and recovery point 4 lies on the same line. In step2302, the Recover_Module 130 creates matrix table 5 by copying theoriginal version of matrix table 3. The original version of matrix table3 is illustrated in FIG. 17. In the graphical representation of the 12sectors in the right column, sector J loses the gray shading whichindicates a sector in use, as it is flagged as RS_Free in matrix table5. In step 2304, the Recover_Module 130 compares the RS_Free sectors inmatrix table 5 to the RS_Free sectors in the working version of matrixtable 4. In step 2306, each RS_Free sector in matrix table 5 that is notalso flagged as RS_Free in matrix table 4, e.g. sector J, is reflaggedas Already_Used in matrix table 5 by the Recover_Module. This is sectorJ. Sector J has already been used in other recovery points, and is notactually free. Note that the arrows representing sector redirectionscreated in recovery points 1-3 are present in the graphicalrepresentation of the 12 sectors, corresponding the Previous_Redirectedsectors in matrix tables 3 and 5. This reflects the state of the harddisk at the creation of recovery point 3.

In the foregoing discussion, an original version and a working versionof the matrix table 122, both corresponding to the same recovery point,have been discussed. In certain embodiments, the original version issaved to the hard disk 114 while the working version is stored in theRAM. After the creation of a new matrix table corresponding to a newrecovery point, the working version of the previous matrix tablecorresponding to the previous recovery point may be erased oroverwritten to save space. For example, as discussed above with regardto FIG. 22, when the Recover_Module 130 creates matrix table 4 whencreating recovery point 4 to recover to recovery point 1, part of theprocess involves comparing RS_Free sectors with the working version ofmatrix table 3. After the comparison is performed and the newly createdmatrix table 4 is saved as an original version, the working version ofmatrix table 3 is no longer needed. Thus the sector management system150 can overwrite the working version of matrix table 3 with the workingversion of matrix table 4. The working version of matrix table 3 is usedto track changes after the creation of recovery point 4.

In further embodiments, the above described systems and methods areemployed on a remote server computer that is accessible via a network.In these embodiments, the system is configured similarly to that shownin FIG. 1 where the computer system 10 is a server computer. In certainembodiments, the server computer includes a higher level of softwarethat performs additional functionality typically allocated to servercomputers, e.g., servicing memory access, controlling memory requestsand resolving memory conflicts. In systems having, for example,specialized memory devices such as Advanced Technology Attachment (ATA)devices or Redundant Array of Independent Disks (RAID), the system takesinto account additional considerations, e.g., data striping or diskmirroring.

In addition to creating recovery states, as illustrated and described inrelation to at least FIGS. 11, 16, 20 and 23, the sector managementsystem 150 is additionally configured to delete or remove one or moresaved recovery points. In the case where the recovery point to beremoved is the most recently saved recovery point, e.g., the lastrecovery point, the recovery point can be removed by deleting theassociated matrix table. For example, referring to FIG. 16, recoverypoint 3 (the most recently saved recovery point in FIG. 16) could beremoved by deleting the matrix table for recovery point 3, which isshown in FIG. 17. In this example, after the removal of recovery point3, two recovery points would remain, namely recovery point 1 andrecovery point 2. Upon removal of a saved recovery point, the memorylocations used by the matrix table can be released or freed up and madeavailable for other use by the computer system. In addition, memorylocations that are no longer needed due to the removal of the recoverypoint can also be released for other use. This is discussed in greaterdetail below.

For the cases where the recovery point to be removed is not the mostrecently saved recovery point, e.g., removing an intermediate recoverypoint for which there is at least one prior recovery point and at leastone subsequent recovery point, one or more additional steps may beperformed. For example, in addition to removing the matrix tableassociated with the recovery point as described above, the matrix tableassociated with the recovery point to be removed may be compared to thematrix table associated with the first recovery point and the matrixtable associated with the last recovery point. If the matrix tablesassociated with the first and last recovery points do not contain anentry, e.g., a memory location such as a disk sector, that is in theintermediate recovery point, the intermediate recovery point can beremoved by deleting the associated matrix table as well as the datastored in the memory location.

To illustrate by way of specific example, suppose that recovery points1, 2 and 3 have been saved and recovery point 2 is to be removed. Inthis example, the matrix tables associated with recovery points 1, 2 and3 are as follows:

Recovery Point 1

Already_Used: A B C

Recovery Point 2

Already_Used: C

Current_Redirected: A B

RS_Used: E F

Recovery Point 3

Already_Used: B

Current_Redirected: A C

RS_Used: E G

If any memory locations that are used in the recovery point beingremoved are not used in the other recovery points, these memorylocations can be released. In the present example, before removing thematrix table associated with recovery point 2, it is compared with thematrix tables associated with recovery points 1 and 3. Here, sector A isused in recovery point 2, as indicated by its Current_Redirected statusin the matrix table. Since sector A is also used in recovery points 1and 3, as indicated by its Already_Used and Current_Redirected status,respectively, sector A is not released. Similarly, sectors B and C arenot released.

Sector F is also used in recovery point 2, as indicated by its RS_Usedstatus. However, sector F is not present in the matrix table forrecovery points 1 and 3. Therefore, sector F is not needed after theremoval of recovery point 2, and the memory space used by sector F canbe released and made available for other use by the computer system (asdescribed below). However, since sectors E and G are marked as RS_Usedin the matrix table for recovery point 3, they are not released whenrecovery point 2 is removed.

As noted in the above examples, when memory locations are no longerneeded due to the removal of a recovery point, the memory may bereleased and made available for other use by the computer system. Memorycan be released, for example, by altering the FAT table to indicate thatthe memory is no longer used by the system. As a further example, memorylocations may be released by invoking an interface of the operatingsystem, such as an application program interface (API), that performsoperating system instructions that cause the memory to be identified asavailable for use by the system. In addition to releasing memorylocations that are no longer used by the sector management system 150,removing a recovery point is also beneficial in that the memory used tostore the matrix table itself may be released, such that this releasedmemory is then available for other use by the computer system.

While the above description of the sector management system has includedvarious embodiments in which the storage and retrieval of recoverypoints or sector states has been initiated by the pressing of certainfunction keys on a computer keyboard, other embodiments utilizedifferent mechanisms. For example, the sector management system mayinitiate the storage or retrieval of sector states at a specific time ofday or on a specific date, for example, by utilizing the timerfunctionality available on many computer systems. Several examples oftimer events that may be utilized include the time counting down to azero value, or counting up to a predetermined value.

In addition, the storage or retrieval of sector states may be initiatedupon the satisfying of one or more predetermined conditions or upon theoccurrence of one or more events. A predetermined condition is acondition or event that is identified and selected prior to theoccurrence of the condition or event. For example, the sector managementsystem may be configured to automatically store a recovery point when anew software application is loaded onto the computer system or when anew revision of the operating system or software application isinstalled onto the computer system. As an additional example, the systemmay be configured to automatically retrieve a recovery state upon theoccurrence of a certain system error or the detection of corrupted datathat may cause operating system or application program errors.

Additional embodiments utilize the recovery points as configurations ofthe computer system using the systems and methods previously described.Thus, the sector management systems can be utilized to implementconfiguration management features to switch between various versions ofthe operating system, operating environment, application programs, testversion configurations, or releasable levels of the computer system.

Configuration management features include version control capabilitiesto switch between certain configuration states (stored as recoverypoints) depending on the version of the operating system or applicationprogram that is desired for a computer system or user. This typicallyoccurs when the system is booted or the user logs on. In other words,various configuration states may be stored as recovery points thatcorrespond to particular operating system, operating environment, orapplication program versions. For example, a recovery point 1 canrepresent the Windows 98 version of the operating system, a recoverypoint 2 can represent the Windows ME version of the operating system,and a recovery point 3 can represent the Windows NT version of theoperating system. Similarly, recovery points can correspond to varioustest configurations or test versions for users that utilize features ofthe sector management system 150 to control or manage various versionsof the operating environment while performing test procedures.

In the embodiments in which the enterprise manager functionality isutilized on a remote computer system, the various operating system orapplication program versions may exist on the remote computer system,and be updated or downloaded to the computer system being logged on tovia the network. The sector management system also allows the comparisonof the version of a file corresponding to a certain recovery state withanother version of the file corresponding to a different recovery state.The sector management system is further capable of storing andretrieving recovery states that correspond to releasable levels of theoperating system or application programs. For example, a user can storea first computer state, load a new version of a particular applicationprogram, store a second computer state, load an update to the operatingsystem, store a third computer state, load a new version of anotherapplication program, and store a fourth computer state. If it isdiscovered that the new or updated versions of the application programsor operating system causes, for example, errors, unpredictablebehaviors; or crashes of the computer system, the user can back out theupdate(s) by restoring to a previous, known working version of thecomputer system.

The sector management system additionally includes security features,for example, that cause the computer system to be inoperable whenaccessed by an unauthorized user. For example, different recovery pointsor sector states may have different protection criteria for restrictingaccess to protected partitions or sectors. Thus, some recovery statesmay allow access to certain partitions by a particular user, while otherrecovery states may not allow access to the same partition by adifferent user. In addition, recovery states may include passwordinformation, so that passwords that have been changed, for example,without proper authorization, may be restored to the previous validpassword by recovery to a state prior to the unauthorized change.

Other security features of the sector management system include thecapability to configure the computer system to crash upon access by anunauthorized user, such as in the case of the physical theft of thecomputer system. For example, the sector management system may beconfigured to have a recovery state that causes the computer system tobe inoperable, and to retrieve the inoperable recovery state uponunauthorized access so that the computer system becomes inoperable. Inthis case, the computer system can be recovered by restoring to apre-crash state, after entry of an authorized password. The securityfeatures described above are optional and configurable, however, as thesector management system also can execute in a non-secure mode, orvarious levels of security in which certain security features may beselectively turned on or off. For example, in a non-secure mode ofoperation, any user can remove existing recovery points, any user canstore new recovery points, and any user can retrieve any recoverypoints. In other example, only certain users are authorized to add,remove and retrieve certain recovery point. As an illustration, one usermay not be able to retrieve recovery points stored by any other user orby other users in a different group.

The sector management system can additionally include various multi-useror multi-project system features. Examples of multi-user featuresinclude the capability to switch to certain recovery states depending onthe particular user that has logged on. In this way, the state of thecomputer system can be different for different users or classes ofusers, and is transparent to the user. For example, recovery points canbe stored that correspond to a specific user, such that when the userlogs in to the computer system, the recovery point corresponding to theuser's specific computer system configuration can be retrieved. Inaddition, groups of users can be assigned certain attributes, forexample, users that work in a particular department or on a particularproject, such that recovery points can be automatically retrieved whenany one of the users in the group logs in. In addition, the sectormanagement system can switch to project-specific recovery states,according to the project that the particular user is assigned to, or iflogins are specific to a particular project (such as users working onProject Alpha who access the computer system using a specific ProjectAlpha login, and a recovery state is restored that configures the systemfor use by Project Alpha users). Thus, computer systems can beconfigured with multiple profiles to provide project partitioning andsupport for a number of various project configurations. Still further,computer systems can be configured as shared systems that provide aseparate state for each of a multitude of operators to enable a shiftoperation capability, for example, three shift operators can share asingle computer system.

The sector management system additionally provides the capability toview and/or recapture data and/or files as they existed in a recoverypoint. For example, a user of the computer system may save two recoverypoints, for example, recovery point 1 and recovery point 2. Afterrestoring the computer system to recovery point 1, the user can copyvarious data files as they existed in recovery point 2. The savedrecovery point 2 can be accessed by creating or mounting a virtualdrive, for example, by invoking an interface to the operating systemsuch as an application program interface (API). For example, the Windows2000 operating system includes such an API. That API creates a read onlyvirtual drive based upon provided memory locations. Therefore, thesector management system provides the list of memory locations whichcorresponds to recovery point 2 to the API. The API then generates thevirtual drive. Files located on the virtual drive can be read andcopied. Alternatively, the sector management system can include a moduleto perform this function.

The data files can then be copied from the virtual drive to the activeoperating environment. By creating a virtual drive, certain data storedon the memory or hard disk can appear to the operating system as aseparate device, although it is in fact physically located on the memoryor hard disk. A virtual drive is typically a read only device, in thatdata can be read from a virtual drive but data may not be written orcopied to the virtual drive. Once the desired data files are copied intothe current operating environment, the virtual drive may be deleted ordismounted, after which the drive is no longer visible to the operatingsystem and the data contained therein is not readily accessible.

The sector management system also allows for faster scanning andrecovery after a computer virus, worm, or other program or piece ofcomputer code that is loaded onto a computer system without the user'sknowledge and runs against the user's wishes, usually in a destructiveor malicious manner. After such a virus or worm is detected, the user ora system operator typically executes a virus scanning program to checkall or a substantial number of the files on the computer system for thepresence or infection of the virus or worm. However, where computerstates have been saved using the sector management system as describedabove, the virus scanning program would only need to check the sectorsthat have been modified after the virus was detected. The files orsectors modified prior to the infestation of the virus or worm would notbe affected and thus would not need to be scanned. This feature couldpotentially speed up, sometimes by a significant amount, the timerequired to scan the computer system for presence of a virus or worm.

While the above detailed description has shown, described, and pointedout novel features of the invention as applied to various embodiments,it will be understood that various omissions, substitutions, and changesin the form and details of the device or process illustrated may be madeby those of ordinary skill in the technology without departing from thespirit of the invention. This invention may be embodied in otherspecific forms without departing from the essential characteristics asdescribed herein. The embodiments described above are to be consideredin all respects as illustrative only and not restrictive in any manner.The scope of the invention is indicated by the following claims ratherthan by the foregoing description.

1-61. (canceled)
 62. A computer-implemented method comprising: creatinga first recovery point that is configured to confer protected status ondata stored in memory in association with the first recovery point,wherein the first recovery point remains until initiation of deletion ofthe first recovery point; and redirecting a write request from a firstmemory location that stores data associated with the first recoverypoint to a second memory location.
 63. The computer-implemented methodrecited in claim 62, wherein the second memory location corresponds to asecond recovery point that remains until initiation of deletion of thesecond recovery point, wherein the second recovery point is configuredto confer protected status on data stored in the memory in associationwith the second recovery point.
 64. The computer-implemented method asrecited in claim 63, further comprising deleting the second recoverypoint while preserving the data stored in the memory in association withthe first recovery point so the first recovery point is usable torestore a computer system that implements the computer-implementedmethod to a state associated with the first recovery point.
 65. Thecomputer-implemented method as recited in claim 64, further comprisingrestoring the computer system to the state associated with the firstrecovery point.
 66. The computer-implemented method as recited in claim63, further comprising deleting the first recovery point whilepreserving the data stored in the memory in association with the secondrecovery point, the data stored in memory in association with the secondrecovery point being usable to restore a computer system to a state thatis associated with the second recovery point.
 67. Thecomputer-implemented method as recited in claim 62, further comprisingredirecting a subsequent write request from the second memory locationto a third memory location, the second memory location being associatedwith a second recovery point and the third memory location beingassociated with a third recovery point, the third recovery pointconfigured to restore a computer system to a state that is associatedwith the third recovery point independent of deletion of one or more ofthe first or second recovery points.
 68. The computer-implemented methodas recited in claim 62, wherein a relationship between the first memorylocation and the second memory location is indicated in a table that istransparent to a file system executing on a computer system that is toperform the computer-implemented method.
 69. A computer-implementedmethod comprising: comparing an address for a first location in memorywith a table to determine whether the first location is identified asprotected in the table, redirecting a write access command from thefirst location to a second location in memory, responsive to adetermination that the second location is not identified as protected inthe table and the first location is identified as protected in thetable; comparing the address of the first location with the table todetermine whether the first location is identified as protectedresponsive to receipt of a subsequent write access command directed tothe first location; and redirecting the subsequent write access commandfrom the first location to a third location in the memory responsive toa determination that the third location is not identified as protectedin the table and the first location is identified as protected in thetable.
 70. The computer-implemented method as recited in claim 69,further comprising: updating the table to indicate a relationshipbetween the first location and the second location in response toredirecting the write access to the second location; and substituting arelationship between the first and third locations for the relationshipbetween the first and second locations in the table.
 71. Thecomputer-implemented method as recited in claim 70, wherein the updatingthe table comprises creating a new table that is a copy of the tablewith the second location substituted for the first location.
 72. Thecomputer-implemented method as recited in claim 69, wherein the tablecomprises a file allocation table.
 73. The computer-implemented methodas recited in claim 69, wherein locations in the memory that are notprotected do not include data at a point in time when a determination ofthe locations' protected status is made.
 74. The computer-implementedmethod as recited in claim 69, wherein the table is transparent to afile system executing on a computing system that performs thecomputer-implemented method.
 75. An apparatus comprising: memoryembodying processor-executable instructions; one or more processorscoupled to memory, the processor-executable instructions beingexecutable to cause the one or more processors to: create a firstrecovery point in the memory that confers a protected status on datastored in a first group of memory locations; redirect a write requestfrom a memory location within said first group of memory locations to adifferent location in the memory that is not associated with the firstrecovery point; create a second recovery point in the memory thatcorresponds to a second group of memory locations that includes thedifferent location, wherein the second recovery point is usable toconfer protected status on the second group of memory locations; andindependently recover the apparatus through use of the data in saidfirst group of memory locations or the data stored in the second groupof memory locations.
 76. The apparatus as recited in claim 75, whereinthe instructions are further executable, by said processors, to causesaid processors to restore the apparatus to a state that corresponds tothe first recovery point or the second recovery point independent ofdeletion of other recovery points in the memory at a point in time atwhich the apparatus is recovered to the state.
 77. The apparatus asrecited in claim 75, wherein the memory comprises a local storagedevice.
 78. The apparatus as recited in claim 75, wherein theinstructions are further executable, by said processors, to cause saidprocessors to maintain a file allocation table to track entries thatindicate addressable locations in the memory for the first group ofmemory locations and the second group of memory locations and redirectof the subsequent write request to an addressable location included inthe third group of memory locations.
 79. The apparatus as recited inclaim 78, wherein the file allocation table is transparent to a filesystem configured to execute on the apparatus.
 80. The apparatus asrecited in claim 78, wherein the instructions are further executable, bysaid processors, to cause said processors to create a third recoverypoint in memory that is configured to confer a protected status on datastored in a third group of memory locations responsive to reception of asubsequent write request to an addressable location in the memory thatis associated with the first recovery point.
 81. The apparatus asrecited in claim 79, wherein the instructions are further executable, bysaid processors, to cause said processors to create a table thatindicates a relationship between the addressable location in the memorythat is associated with the first recovery point and an addressablelocation in the memory that is associated with the third recovery pointat which the subsequent write request is to be stored.